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The fuel tank isolation as a result of leak or rupture can leave an Orion Crew Module 
with only half of the loaded propellant for ISS return atmospheric entry. To assess the feasi- 
bility of returning under this condition, an analysis of various entry control options with de- 
liberate degradation of control performance was performed. The study determined that a 
ballistic entry without a raise burn, a steeper flight path trajectory, relaxed atmospheric 
pitch/yaw rate damping, and degraded touchdown control could achieve 2-o requirements 
compliance with a 2-o fuel usage that is less than half of the liftoff propellant loading. The 
results of this analysis indicate that an entry with only half the nominal propellant load is 
feasible following a tank isolation fault. 


Nomenclature 


GN&C 

= 

guidance, navigation, and control 

CEV 

= 

crew exploration vehicle 

CM 

= 

crew module 

El 

= 

entry interface 

ISS 

= 

International Space Station 

LAS 


launch abort system 

LMG 

= 

loads managed guidance 

RCS 

= 

reaction control system 

SA 

= 

spacecraft adepter 

SM 


service module 

/sp 

= 

specific impulse, s 

R 

— 

roll jet 

P 

= 

pitch jet 

Y 

— 

yaw jet 


I. Introduction 

1 he Orion Crew Exploration Vehicle (CEV) was part of the NASA Constellation program, which was aimed at 
replacing the Space Shuttle with a vehicle that could deliver crew to the International Space Station (ISS). The CEV 
was to be launched on top of the station 1000 

Crew Launch Vehicle (CLV), 
also known as Ares I. Although 
the Constellation program has 
been largely canceled, the CEV 
is still in development as the new 
Multi-Purpose Crew Vehicle. It CEV+X 
is planned to be launched on an 
as yet unidentified launch ve- 
hicle. Figure 1 shows CEV in 

Figure 1. Orion CEV as part of Ares I upper stage. 
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SA Coin 



LAS 



the original configuration as part of the Ares I upper stage. 

As shown in Fig. 2, the Orion spacecraft is composed of three modules: a Crew Module (CM); an expendable 
Service Module (SM); and a Spacecraft Adapter (SA) to interface with the launch vehicle. Figure 2 also shows an 
expendable Launch Abort System (LAS) 
module. 

While the vehicle is located at the ISS, 
the CM is mated to the SM; the LAS and 
SA components are jettisoned during as- 
cent. During return (see Fig. 3), the SM 
reaction control system (RCS) delivers the 
SM-CM vehicle to the targeted deorbit 
attitude, then the SM is jettisoned, and a 
CM raise bum is performed. The CM 
raise burn is used to shallow the CM 
flight-path angle and to extend downrange 
distance to ensure that the CM remains 
outside the SM debris footprint. At the 
end of the CM raise burn, the CM reo- 


Figure 2. Orion CEV vehicle configuration. 
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Figure 3. CM event sequence. 1 


rients to an entry interface (El) atti- 
tude and enters the El at 400,000 ft. 

The CM RCS is characterized by 
two redundant jet strings, A and B, 
which can be fired independently or 
concurrently (i.e., bi-level firing). A 
simplified propellant fuel schematic is 
shown in Fig. 4. The RCS strings are 
fed propellant from two separate sets 
of propellant tanks. In the case of 
tank leakage or mpture, the damaged 
tank is isolated by closing the line 
valves; this type of problem is consi- 
dered a contingency fault. The result 
is that one-half of the propellant and 
the pressurant is unavailable to the 
propulsion system. 

Various entry options with delibe- 
rate degradation of control perfor- 
mance were identified and analyzed 
to determine whether a return on one- 
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Figure 4. Simplified tank feed schematic. 
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half of the available propellant would be feasible. The goal was the safe return of the crew to the surface with com- 
pliance for all guidance, navigation, and control (GN&C) performance metrics. The study determined that ballistic 
entry with no CM raise bum, a steeper flight-path trajectory, relaxed atmospheric pitch and yaw rate damping, and 
degraded touchdown control could achieve compliance with GN&C requirements with fuel usage that was equiva- 
lent to less than one-half of the liftoff propellant loading. 


II. Setup and Assumptions 

Because half of the pressurization system is lost, the tank isolation fault causes thmst and specific impulse (/ sp ) 
reductions that are greater than those that occur during nominal operation. Hardware constraints limit the system to 
the simultaneous firing of no more than four simultaneous jets firing after a tank isolation fault. As a result, a sin- 
gle-string operation is the preferred operational mode for a tank isolation scenario. A single string consists of ±-roll, 
±pitch, and ±yaw jets. Strings A and B are identical in both thmst and / sp magnitude and have similar locations on 
the CM body. Figure 5 shows the CM RCS positions for strings A and B (thrusters are identified with an ‘R’, 6 P’, or 
‘Y’ to indicate roll, pitch, or yaw, respec- 


tively). The logic to determine whether 
one or both strings are used is dependent 
on the flight phase, the necessary amount 
of thmst, and the flight mode. 

Tank isolation event requires multiple 
faults: a tank mpture or leak or a low 
probability event, such as a micro- 
meteoroid hit. Therefore, tank isolation 
is considered a contingency fault. For the 
purposes of this study, the assumption 
was made that performance requirements 
and CM propellant usage could be judged 
to a relaxed compliance level (i.e., 2 -o 
rather than 3 -a). Therefore, feasibility 
was considered to be demonstrated if 2 -o 
compliance was achieved. 

The propellant budget was assumed 
to be 330 lbm for an ISS return scenario 
starting at deorbit bum. Therefore, a 
return on one-half of the available propel- 
lant would require that the vehicle use no 
more than 165 lbm of propellant during 
the flight. For consistency, the same ver- 
sion of the simulation software that was 
used to generate the original 330 lbm 
propellant budget was also used for this 
study. Furthermore, the assumption was 
made that minimal fuel was lost from the 
“available” tanks as a result of cross-fed 
fuel lines prior to the detection and isola- 
tion of the damaged tanks. Calculation of 
any fuel loss from the available fuel tanks 
is neglected in the study. 


Origin not to scale -i-Z 



Figure 5. CM cutaway. 
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III. Results 


Three nominal contingency modes were examined as possible solutions: constant-bank, ballistic, and loads- 
managed. All three modes were simulated by using a 3000 run Monte Carlo from the deorbit point with a single- 
string RCS and without a CM trajectory raise burn. Table 1 shows the mean and maximum propellant usage for the 
three modes segregated by entry flight phase. Table 2 shows end-to-end fuel usage statistics, including the mini- 
mum, mean, maximum, l- a, and 2- cr fuel usages. For a one-sided distribution problem, 2 - a is defined as the 57 th 
highest fuel usage, and 1-cris defined as the 450 th highest fuel usage. For the touchdown heading requirement, the 
2- cr compliance has no more than 57 heading violations. 


Table 1. Flight Phase CM Propellant Usage for Entry Abort Modes with no Raise Burn 



Deorbit to El 

El to 
drogue 
deployment 

Drogue 
deployment 
to touchdown 

Touchdown 

heading 

violations 


Mean 

(lbm) 

Max 

(lbm) 

Mean 

(lbm) 

Max 

(lbm) 

Mean 

(lbm) 

Max 

(lbm) 

— 

Constant-bank 

4.45 

6.43 

35.89 

63.10 

61.75 

165.23 

2 

Ballistic 

4.45 

6.43 

51.09 

82.58 

63.39 

158.66 

6 

Loads-managed 

7.67 

9.32 

42.48 

71.92 

62.32 

164.69 

2 


The "Touchdown Heading Violation" column in Table 1 shows the number of cases from each abort mode that 
exceeded the earth relative velocity direction in the +Z axis during touchdown by the amount indicated by the green 
outline in Figs. 6 and 7. The required velocity direction accuracy is necessary to ensure crew survival during a wa- 
ter landing. 


Table 2. End- to-End CM Propellant Usage for Entry Abort Modes with no Raise Burn 



Min (lbm) 

Mean (lbm) 

Max (lbm) 

2-o (lbm) 

l-o (lbm) 

Constant-bank 

36.61 

102.09 

221.78 

186.68 

140.93 

Ballistic 

62.67 

119.20 

229.23 

200.94 

153.97 

Loads-managed 

53.94 

112.48 

231.54 

198.50 

151.35 


All three of the presented contingency modes used less than one-half of the available propellant with 1 -o com- 
pliance but not with 2 -o compliance. The constant-bank mode had the lowest propellant usage of the three modes. 
For all three cases, the "Drogue to touchdown" phase of the flight required almost one-half of the loaded propellant 
for the worst cases. Thus, the largest saving in propellant resulted from modifying the touchdown controller while 
still maintaining 2 -o compliance with the heading at landing. Another option was to wait on orbit for calm winds 
and simply not use the touchdown control. In this case, the unmodified entry abort modes were sufficient to achieve 
a landing on one-half of the available propellant. 

The entry abort modes can be modified in several other ways to reduce propellant consumption, including: 
relaxing the algorithm data settings (i.e., gains and deadbands), degrading the touchdown controller, and flying a 
steeper entry trajectory to reduce the atmospheric flight time. For the purposes of this study, it is assumed that the 
tank isolation is Fault Detection, Isolation, and Recovery driven and that the modification of data settings is permiss- 
ible following a tank isolation event. In this study, changes to the algorithm were not permitted; only changes to the 
GN&C data were allowed. Because touchdown control was the major source of fuel consumption in the baseline 
cases that are described in Tables 1 and 2, two options for degrading the touchdown controller were evaluated. One 
option eliminated the use of the RCS jets to damp the roll rates for CM while the drogue chutes are deployed, and 
the other relaxed the rate limit settings for the anti-twist algorithm that is used while the main chutes are deployed. 
The objective of these two touchdown control changes was to reduce fuel consumption while still achieving 2-a 
compliance for the touchdown heading envelope at landing. Tables 1 and 2 indicate that the ballistic abort mode 
consumes more fuel than the constant-bank or the loads-managed modes; thus, another consideration was to relax 
the control gains for the ballistic mode. In particular, with the use of the default settings in the ballistic mode, an 
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excessive number of pitch and yaw jet firings were noted at subsonic speed. This can be seen in Table 3 by examin- 
ing the total on-time statistics for each CM RCS jet for the ballistic mode (without a CM raise bum). To reduce the 
number of pitch and yaw firings, a reduction in the pitch and yaw rate damping control gains ( K q and K x ) was eva- 
luated. For this study, the criterion for selecting new gains was the verification that the vehicle did not tumble prior 
to deployment of the drogue chutes. 


Table 3. Jet On-Time Statistics Per CM RCS Jet for Ballistic Entry 



Pre-EI 

El to Mach 2 

Mach 2 to drogue 
deployment 

Drogue deployment to 
touchdown 


Max 

Mean 

Max 

Mean 

Max 

Mean 

Max 

Mean 


(s) 

(s) 

(s) 

(s) 

(s) 

(s) 

(s) 

(s) 

+ R 

1.63 

0.85 

42.93 

7.73 

3.83 

0.55 

130.83 

49.30 

-R 

1.63 

0.88 

53.10 

14.40 

5.50 

1.20 

125.35 

39.37 

+ P 

2.15 

1.72 

4.80 

1.70 

16.23 

10.92 

0.05 

0.00 

-P 

2.43 

1.85 

5.80 

2.41 

17.10 

11.76 

0.05 

0.00 

+ Y 

0.83 

0.44 

2.48 

0.72 

15.63 

9.88 

0.05 

0.00 

-Y 

0.93 

0.49 

1.83 

0.39 

16.73 

9.95 

0.05 

0.00 


Table 4 shows the propellant usage results for the various modification options for the ballistic and constant- 
bank mode entry trajectories. All of the options that are presented below have no rate damping while the touchdown 
control is in use. The ballistic mode was selected for further study over the loads-managed guidance mode because 
it is the simplest and most reliable entry abort mode to use in a contingency situation. The constant-bank mode is 
also being considered because it is a simple flight mode and because it tends to demonstrate a lower total 2 -o propel- 
lant consumption. It should be noted that the constant-bank mode is not a baselined entry down mode; however, 
constant-bank flight can be achieved fairly easily by (1) flying manual bank control, (2) using loads-managed guid- 
ance with suppressed bank reversal, or (3) using the entry constant-bank mode created to follow an ascent abort. 


Table 4. End- to-End CM Propellant Usage for Various Degraded Entry Abort Modes 


(lbm) 

Min 

Mean 

Max 

2-o 

1-0 

Touchdown 

Heading 

Violations 

One or More 
Cases Touching 
Down on Land 

Ballistic 

Nominal 

62.17 

117.35 

207.73 

182.04 

152.46 

26 

N 

Relaxed anti-twist 

62.17 

115.45 

199.41 

175.96 

146.61 

47 

N 

-3.0 deg flight path 

60.28 

110.90 

192.55 

179.79 

151.89 

30 

N 

-3.0 deg flight path, 
relaxed anti-twist 

59.46 

114.51 

198.56 

174.14 

145.92 

49 

N 

-3.0 deg flight path, 
relaxed anti-twist, 
1/2 gains 

45.11 

101.37 

185.40 

160.60 

132.54 

46 

N 

-3.0 deg flight path, 
1/4 gains 

38.89 

95.38 

186.77 

162.38 

132.92 

23 

N 

Constant Bank 

0 deg 

36.03 

100.93 

182.78 

168.70 

140.68 

18 

Y 

60 deg 

53.99 

110.72 

197.89 

176.77 

149.38 

26 

N 

Odeg, 

relaxed anti-twist 
-1.8 deg flight path 
angle 

35.75 

95.09 

173.48 

160.58 

132.74 

44 

Y 

Odeg, 

relaxed anti-twist, 
-3.0 deg flight path 

46.48 

99.13 

181.19 

162.58 

134.45 

62 

N 






















In Table 4, four possible solutions are evident that achieve a 2 -o fuel usage of less than 165 lbm (these are 
shown in the table in bold and italics). However, the two constant-bank cases that are 2-c fuel compliant are defi- 
cient in other areas. The case with the nominal (-1.8 deg) flight-path trajectory had a large number of cases that 
touched down on land; the case with the steep flight-path trajectory had touchdown heading violations in excess of 
those permitted for 2 -o compliance. Both of the ballistic cases were successful in that the touchdown heading accu- 
racy was 2-o compliant and that all cases landed in the water. Furthermore, no cases tumbled prior to deployment of 
the drogue chutes despite the reduction in pitch and yaw rate damping gains. 

As the touchdown control is degraded, the touchdown heading violations increase in number. Figures 6 and 7 
show the touchdown plots for the nominal ballistic mode and for the ballistic mode with no drogue damping, respec- 
tively. The heading violations increased from 6 for the nominal ballistic mode (Fig. 6) to 26 for the ballistic with no 
drogue damping (Fig. 7). 



Horizontal Velocity (m/s) Horizontal Vetoc ity (m/s ) 

Figure 6. Nominal ballistic touchdown heading. Figure 7. Ballistic touchdown heading without drogue 

damping. 

Figures 8 and 9 show the touchdown orientation plots for the nominal constant-bank mode and the constant-bank 
mode with no drogue damping, respectively. The number of heading violations increased from only 2 for the no- 
minal constant-bank plot (Fig. 8) to 18 for the constant-bank plot with no drogue damping (Fig. 9). 



Ho riaontel Veloc ity (m/s) H orizontal Velocity (m/s) 

Figure 8. Nominal constant-bank touchdown heading. Figure 9. Constant-bank touchdown heading without 

drogue damping. 
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The constant-bank mode with a 0 deg bank command flies lift up. As a result, a significant portion of the cases fly a 
long trajectory with a touchdown occuring on land. In order to avoid a touchdown on land, a steeper trajectory with 
flight path angle of -3.0 deg can be used. Figure 10 shows the constant-bank landing point for a 0 deg bank 
command with a nominal flight path angle of -1.4 deg. Figure 1 1 shows a constant-bank landing plot with a 60 deg 
bank command for a flight path angle of -1.4 deg. Figure 12 shows a simulation with a 0 deg bank command but 
with the steeper flight-path angle of -3.0 deg. 




Figure 10. Constant-bank landing points using 0 deg 
bank command. 


Figure 11. Constant-bank landing points using 
60 deg bank command. 



Figure 12. Constant-bank landing points using 0 
deg bank command and steep flight path (-3.0 deg). 


Care must be taken in designing trajectories that use a constant-bank entry. A lift-up, 0 deg bank-lofted trajec- 
tory can reach land if the initial flight-path angle is not adjusted to provide a steeper trajectory. More analysis may 
also be needed to ensure that thermal heat loads are not violated. For these reasons, a ballistic abort entry is the pre- 
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ferred down mode for reduced propellant usage. Ongoing optimization of the flight control gains and deadbands for 
the ballistic mode should result in a simple, robust algorithm with good performance and low fuel usage. 


IV. Conclusion 

Achieving a safe crew module (CM) entry following departure from the International Space Station is feasible 
using less than half of the available propellant if we assume that the verification compliance can be relaxed to a 2-a 
level. Going forward, more research is required to select the best design for guidance, navigation, and control entry 
operations after a CM propulsion tank isolation fault. One potential solution is to fly a ballistic entry abort mode 
with no CM raise burn and with degraded touchdown control settings. The flight control gains for the ballistic mode 
may need refinement to minimize fuel usage with a minimum impact on stability and performance. 
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